Skip to content
GitmoapAPIBeta
Organizeaccess
GET/repositories/{repo_id}/access

Who has access to a repository, and why.

list_repo_access
  • access:read
    A token needs the access:read scope: See who has access to a group or repository, and whyGranted by read_api, write_api.Every operation this scope unlocks
  • Single-resource

    x-gitmoap-isolation: {"kind":"single_or_self_scoped"}

  • Paginated
    Pass the next_token a page returns to get the next one.

Lists every live grant that reaches the repository — made on it, or inherited from the groups above — oldest first, each with its holder, role, expiry, reason and any limit narrowing it. Filter by where the grant was made, by the kind of holder, or by a name fragment. Callers who can see who has access here may read it (Reporters and above with the built-in roles); a public or internal repository does not make its access list public.

Parameters

Path
  • repo_idRepositoryId (string · uuid)Repository ID
Query
  • sourceAccessSourceFilterdirectinheritedalloptionalOnly grants made here (direct), only inherited ones (inherited), or both (all, the default)
  • subject_kindSubjectKinduserservice_accountteamoptionalOnly grants to people, service accounts or teams
  • searchstringoptionalA fragment of a username, or of a team's name
  • limitinteger · int64optionalMaximum number of entries, 1-100 (default 50)
  • next_tokenstringoptionalPagination token

Responses

200Every grant that reaches the repositoryapplication/json
  • advanced_in_usebooleanWhether the organization has given a team access, or defined a custom role or a limit. Until it has, access is five roles given to people, and the page reads as a members list.
  • entriesarray of AccessEntryEvery grant that reaches here — made here or inherited — oldest first.
    • The AccessEntry schema
    • created_atstring · date-time
    • grant_idGrantId (string · uuid)
    • roleRoleView
      • The RoleView schema
      • namestringThe role's display name: a built-in name such as Developer, or the custom role's name.
      • rankAccessLevelguestreporterdevelopermaintainerownerThe built-in rank the role counts as wherever a rank is compared, such as a protected branch's minimum.
      • builtinAccessLevelguestreporterdevelopermaintainerowneror nulloptionalSet when the role is built in.
      • customRoleId (string · uuid) or nulloptionalSet when the role is one the organization defined.
    • sourceAccessSource
    • subjectGrantSubject
    • expires_atstring · date-time or nulloptional
    • granted_byActorSummary or nulloptional
    • last_exercised_atstring · date-time or nulloptionalWhen the grant last let somebody do something, to the day. Absent until it has.
    • limited_toarray of AccessLimitoptionalThe limits that take away part of what this grant gives here: set on this group or repository or one above it, naming the grant's holder, a team the person is on, or everyone — or every service account, for one. An organization owner is never limited, so their entries carry none.
      • The AccessLimit schema
      • atAccessScopeWhere the limit is set. It caps its subject there and everywhere beneath, including beneath a group or repository that does not inherit access.
      • created_atstring · date-time
      • limit_idLimitId (string · uuid)
      • subjectLimitSubjectEntry
      • ceilingRoleView or nulloptionalThe most the subject may hold. Absent when the limit allows nothing at all.
      • created_byActorSummary or nulloptional
      • reasonstring or nulloptional
    • reasonstring or nulloptional
  • organization_ownersOrganizationOwners
    • The OrganizationOwners schema
    • countinteger · int64
    • listedbooleanWhether their grants appear among the entries. They do not when this group or repository stops inheriting access, yet the owners reach it all the same.
  • scopeAccessPageScope
    • The AccessPageScope schema
    • full_pathstring
    • idstring
    • inherits_accessbooleanWhether access granted on the groups above reaches it. When it is false, only access granted here — and the organization's owners — reach it.
    • typeScopeTypegrouprepository
  • next_tokenstring or nulloptional
200 exampleSynthesized example
{
"advanced_in_use": false,
"entries": [
{
"created_at": "2026-10-09T02:58:45Z",
"grant_id": "d841c353-34a8-4f39-a3dd-3b2b82031927",
"role": {
"name": "payments-api",
"rank": "guest"
},
"source": {
"at": {
"full_path": "acme/payments-api",
"id": "id-9007",
"type": "group"
},
"kind": "direct"
},
"subject": {
"principal": {
"id": "f4709ae7-8062-4d36-bf69-e335fcef7de2",
"kind": "user",
"username": "lin"
}
}
},
{
"created_at": "2026-10-16T17:22:45Z",
"grant_id": "5dee85c7-2dab-4e63-a4e6-02dc2ca1241b",
"role": {
"name": "payments-api",
"rank": "guest"
},
"source": {
"at": {
"full_path": "acme/payments-api",
"id": "id-b0a1",
"type": "group"
},
"kind": "direct"
},
"subject": {
"principal": {
"id": "6c0bbc77-ce2d-4a39-8055-1a5cfb4fece8",
"kind": "user",
"username": "tomas"
}
}
}
],
"organization_owners": {
"count": 6,
"listed": false
},
"scope": {
"full_path": "acme/payments-api",
"id": "id-5e12",
"inherits_access": false,
"type": "group"
},
"next_token": "next-token-0af7"
}
400Invalid filter or pagination tokenapplication/json
Error codes
  • BAD_REQUESTThe request is malformed: a parameter or a body field is not a well-formed value of its type
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
400 exampleSynthesized example
{
"error": {
"code": "code-1039",
"message": "Pin a page's payload to the build that rendered it"
}
}
401Authentication requiredapplication/json
Error codes
  • UNAUTHORIZEDNo credential was sent, or the one sent is invalid, expired or revoked
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
401 exampleSynthesized example
{
"error": {
"code": "code-8571",
"message": "Draw the region map from operation density"
}
}
403The caller cannot see who has access hereapplication/json
Error codes
  • FORBIDDENYou are signed in but may not do this here; reason names the permission or the rule that refused it
  • INSUFFICIENT_SCOPEThe access token lacks the scope this operation needs; required_scope names it
  • PERMISSION_REQUIREDYou need a permission you do not hold here; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
403 exampleSynthesized example
{
"error": {
"code": "code-b65d",
"message": "Pin a page's payload to the build that rendered it"
}
}
404Repository not foundapplication/json
Error codes
  • NOT_FOUNDThe resource does not exist — or exists and you cannot see it: a private resource you have no access to answers exactly as an absent one does
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
404 exampleSynthesized example
{
"error": {
"code": "code-c896",
"message": "Draw the region map from operation density"
}
}

CLI

gitmoap access list-repo-access

  • --repo-ididRepository ID (id or owner/repo path)
  • --limitnumberoptionalMaximum number of entries, 1-100 (default 50)
  • --next-tokenstringoptionalPagination token
  • --searchstringoptionalA fragment of a username, or of a team's name
  • --sourcedirect | inherited | alloptionalOnly grants made here (`direct`), only inherited ones (`inherited`), or both (`all`, the default)
  • --subject-kinduser | service_account | teamoptionalOnly grants to people, service accounts or teams

Used in these guides